CVE-2026-53702: Gstreamer1-plugins-bad-free: gstreamer: stack buffer overflow in h.265 buffering period sei parser
A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from cpbcntminus1[i] (the loop index) instead of the sub-layer 0 CPB count cpbcntminus1[0] from the referenced Sequence Parameter Set. A crafted H.265 video file or stream can cause the parser to write beyond the bounds of stack-allocated CPB delay arrays, resulting in a crash or potential stack memory corruption.
Other sources
GStreamer H.265 buffering period SEI parser stack buffer overflow. In gsth265parserparsebufferingperiod(), the CPB loop bound used cpbcntminus1[i] instead of cpbcntminus1[0], causing writes past the 32-element CPB arrays on the stack. Fixed in GStreamer 1.28.3 (MR !11334, commit 48c11b7b01). Reported via PSIRTSUPT-7239 by Tianshuo Han.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GStreamer gst-plugins-bad (gstreamer1-plugins-bad-free)to a version that resolves this vulnerability.Fixed in 1.28.3Patch MR !11334, commit 48c11b7b01 - Remove
Remove
gstreamer1-plugins-bad-freefrom your environment.Uninstall the affected gst-plugins-bad H.265 parser package (gstreamer1-plugins-bad-free) if it is not required.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53702?
The severity of CVE-2026-53702 is classified as medium with a score of 6.5.
What type of vulnerability is CVE-2026-53702?
CVE-2026-53702 is a stack buffer overflow vulnerability found in the GStreamer H.265 codec parser.
How do I fix CVE-2026-53702?
To fix CVE-2026-53702, update the GStreamer gst-plugins-bad library to the latest patched version.
What impact does CVE-2026-53702 have on affected systems?
CVE-2026-53702 could lead to denial of service on affected systems due to the buffer overflow.
Which software is affected by CVE-2026-53702?
CVE-2026-53702 affects the GStreamer gst-plugins-bad library.